Introduction

DeepSeek Harness (DSH) runs model sessions, and agents sometimes need to control host services through SSH or shell commands. If commands are mishandled, the model may issue instructions to stop the Harness itself, causing the service to crash. Since this is a normal exit, Restart=on-failure will not trigger a restart.

dsh-self-preserve is a plugin that intercepts these operations and ensures that the Harness itself is not accidentally terminated by a model session.

Plugin Purpose

This is a DeepSeek Harness hook plugin. It is maintained by n8guru and aims to prevent model sessions from stopping the Harness process they are running in.

Core Features

  1. Intercept self-destructing commands
    In Linux environments, it reads /proc/self/cgroup to obtain the systemd unit name of the current Harness. Any command matching systemctl stop/kill/restart that targets its own unit is intercepted and returned with a deny policy.

  2. Support macOS launchd
    In macOS environments, by setting the environment variable DSH_SELF_PRESERVE_TARGET, it can intercept launchd stop, remove, and unload commands for a specific service label.

  3. Preserve read-only permissions
    The plugin only intercepts control operations on its own service while allowing read-only queries for other services.

  4. Logging
    When protection is armed, it logs [dsh-self-preserve] armed for <target>. If the target cannot be discovered or configured, it logs an explicit inactive warning.

Installation

Install the plugin as a local package into the DSH profiles directory:

git clone https://github.com/n8guru/dsh-self-preserve ~/.dsh/local-mods/dsh-self-preserve
cd ~/.dsh/profiles/web      # 以及 profiles/headless（如果使用）
# 在 package.json 的 "dependencies" 和 "dsh.profile.bundles" 中添加：
#   "dsh-self-preserve": "file:../../local-mods/dsh-self-preserve"
pnpm install --ignore-workspace

After installation, a restart must be initiated by an external machine or external supervisor.

Typical Usage

Prevent command injection over SSH

When systemctl stop is invoked in an SSH command and the command is inside a double-quoted string, the local shell may parse it prematurely. The plugin prevents the stop operation on its own Harness:

ssh peer "cat > RUNBOOK.md <<'EOF'
1. `systemctl --user stop deepseek-harness.service`
5. `systemctl --user start deepseek-harness.service`
EOF"

Run tests

The plugin includes a standalone test file that can be run directly:

node --test guard.test.mjs

Use Cases and Considerations

  • Permission dependence: The plugin runs with the permissions of the current DSH process. Review the source code and license before installation.
  • Restart limitation: The plugin cannot restart itself. A restart must be initiated by an external machine or external supervisor.
  • Configuration requirement: If the target cannot be discovered or configured, an inactive warning is logged. This is expected behavior.

Summary

dsh-self-preserve resolves the issue of model sessions accidentally stopping the Harness by performing policy interception during the tools/pre-execute stage. It preserves read-only access to other services and helps ensure workflow stability.